Add first-run permission summary dialog before launch

Shows what access the AppImage will have on first launch. Lists file,
network, and display server access. Mentions firejail if available.
Tracks prompted status in DB so the dialog only appears once per app.

src/core/database.rs

@@ -1770,6 +1770,14 @@ impl Database {
         Ok(())
     }
 
+    pub fn set_first_run_prompted(&self, id: i64, prompted: bool) -> SqlResult<()> {
+        self.conn.execute(
+            "UPDATE appimages SET first_run_prompted = ?2 WHERE id = ?1",
+            params![id, prompted as i32],
+        )?;
+        Ok(())
+    }
+
     // --- Launch statistics ---
 
     pub fn get_top_launched(&self, limit: i32) -> SqlResult<Vec<(String, u64)>> {